Splunk Search

adding comments to search results rows

bbouch
Explorer

I would like to know if it's possible to add a column to the end of my search results with an editable text box in it, so I can add comments to specific rows in my output before printing or emailing the results off to other people. The results of my query can change wildly each time I run it, so adding a static column is not an option for this particular scenario.

For example, I have a query that shows the top 10 exceptions for a given application in the specified timeframe. I'd like to be able to add a comment for each exception that gives a brioef explanation of the issue and/or what has been done to address it.

so, instead of seeing a report that has

nameNotFoundException          1182
Bad Result From Customer Lookup  75

I want to be able to add comments to the end of each result so it looks something like the following when printed/sent off to someone:

nameNotFoundException           1182         Fix scheduled for Oct 22 release
Bad Result From Customer Lookup   75         Ticket 1234 opened with Marketing Run Team 7/30

Is this kind of customization available from within Splunk? I know I can export to a .csv and do it there, but I need to repeat this process multiple times for different teams, so I am looking for a way to streamline it a little from that.

Thoughts/Suggestions?

Tags (2)
0 Karma

yannK
Splunk Employee
Splunk Employee

If the comment supposed to be always the same per category :
the best thing seems to create a lookup on a field (like error field), that has 2 columns "error", "comment"
and apply the lookup at the end of your search to add the comment.
Then you just have to maintain the lookup table.

Get Updates on the Splunk Community!

Splunk Observability Cloud’s AI Assistant in Action Series: Analyzing and ...

This is the second post in our Splunk Observability Cloud’s AI Assistant in Action series, in which we look at ...

Elevate Your Organization with Splunk’s Next Platform Evolution

 Thursday, July 10, 2025  |  11AM PDT / 2PM EDT Whether you're managing complex deployments or looking to ...

Splunk Answers Content Calendar, June Edition

Get ready for this week’s post dedicated to Splunk Dashboards! We're celebrating the power of community by ...